Privacy Policy

ForkMark ("we," "our," or "us") operates the ForkMark mobile and web app ("the App") — a personal restaurant journal that lives on your device, with a recommendation feed you share with friends (or publicly, if you choose) and a dinner-roulette discovery picker. We're committed to protecting the privacy and security of your personal information. This policy explains what data we collect, how it's stored, who can see it, and the rights you have over it.

1. Scope

This Privacy Policy applies to:

• ForkMark mobile app — iOS and Android (TestFlight + Play Store beta, future general availability).
• ForkMark website — forkmark.app (marketing + legal pages).
• ForkMark beta portal — beta.forkmark.app (signup form + tester portal).
• ForkMark management console — manage.forkmark.app (admin tooling, not publicly accessible).

2. Data We Collect

Account info

• Required: email address and password. Authentication is handled by Firebase Authentication; we never see or store your password — Firebase salts and hashes it on its side.
• Optional profile fields: display name, chosen username, bio, home city, birthday, pronouns, dietary preferences, favorite cuisines, default privacy setting, social handles (Instagram, X, website).
• Internal identifier: on first sign-in we assign you an "FM identifier" (e.g. FM000000042). This is internal data used for backend lookups and is not displayed in the app.

Your content — stored on your device

• Journal entries. Restaurant name, rating, optional cuisine, notes, what you ordered, what you liked/disliked, would-return flag, photos, tags, location strings you enter. Journal entries and their photos are stored only on your device (local-first). They are not uploaded to our servers, and we cannot read them.
• Try-list items. Places you want to visit later. Also stored only on your device.
• Because this content lives on your device, we don't back it up. Uninstalling the app or losing the device removes it, and we have no copy to restore.

What syncs to our servers

• Restaurant catalog contribution. To build a shared restaurant catalog (e.g. "4 ForkMark users have been here, average rating 4.2"), the app sends the restaurant's name and address when you save a place, so it can be matched to a shared restaurant record. For each restaurant you've logged or saved, it also syncs a small summary: how many entries you have, the sum of your ratings, and whether you've visited it or want to try it. This summary is stored under your account ID so it can be updated or removed. Only you and our servers can read it. Other users see only the combined totals across all users. Your notes, photos, dates, companions, and the rest of your entry are never included.
• Recommendations. When you publish a recommendation, the place name, your optional note, attached photos, and your thumbs-up/down go to our servers. You choose the audience each time. Friends means you plus the friends you had when you posted. Public means any signed-in ForkMark user can read it, and it can appear in the public discovery feed. Private means only you. Our database rules enforce the audience.
• Profile photo. If you set an avatar, it's uploaded so friends can see it.
• Friends + friend requests. Outgoing and incoming friend requests, the accepted friends list (denormalized with each friend's display name, username, and photo URL so the UI doesn't have to re-fetch).
• Support tickets & beta feedback. When you contact support or submit beta feedback, we collect your message, the category, and diagnostic context (app version, build number, platform, device model) attached to the ticket so we can respond accurately.

Finding friends (optional)

• Contact-discovery index. So people who already have you in their address book can find you, we keep a private index entry with your account email. If you choose to add a phone number, only a SHA-256 hash of it is stored in that entry, and matching uses only the hash. (The number itself stays on your device so the app can show it back to you.) Only you and our servers can read this index. You can remove your phone number at any time in the app.
• Address-book matching. Only if you tap Find Friends → Contacts and grant contacts permission, the app reads your address book on your device. It then sends our server the email addresses in your contacts (lower-cased) and a SHA-256 hash of each phone number. Raw phone numbers, names, and other contact details never leave your device. The server compares these against the discovery index, returns the matching ForkMark users, and does not store the list you sent.

Behavioral & diagnostic

• Location (only when you ask). Discover ("dinner roulette") can use your device GPS to find nearby restaurants. Location is used for that single search and is not stored on our servers or attached to your account. You can decline the permission and search by ZIP code instead.
• Crash & performance data. Via Firebase Crashlytics. Crash reports include stack traces and device class but never include journal content or other personal data.
• Anonymous usage analytics. Via Firebase Analytics. We log a small set of events (sign-up, friend added, recommendation published) and screen-view names. We don't log restaurant names, journal text, or message contents.

3. How Your Data Is Stored and Secured

• In transit: Every connection between the app and our servers uses HTTPS/TLS. Insecure HTTP is rejected.
• On your device: Journal entries, try-list items, and journal photos are kept in the app's private storage on your device, protected by your device's own security (passcode and OS-level encryption).
• At rest (cloud): The data that does sync (account, profile, recommendations, friends, catalog contributions, contact-discovery index, support tickets) is stored in Google Firebase: Firestore for structured data and Cloud Storage for recommendation photos and avatars. Firebase encrypts data at rest by default with industry-standard AES.
• Document-level access control: Firestore security rules enforce per-document ownership. Your catalog contributions and contact-discovery entry can only be read by you (and our servers). Friends-only recommendations are gated by an explicit "visible to" list stamped at create time: friends you had when you posted, plus you. Public recommendations are readable by any signed-in user. Recommendation photos and avatars are readable by signed-in users because they appear in feeds.
• Authentication: Sign-in is email/password by default. Two-factor authentication via authenticator apps (TOTP) is wired and available for future enablement.
• Sign-out: Signing out clears the app's cloud-data cache. Your on-device journal stays on the device, tied to your account, and is only shown again when you sign back in to that account.
• Backend operations: Sensitive multi-document mutations (friend accept/decline, FM identifier allocation, recommendation visibility cleanup on defriend) run server-side via Cloud Functions using the Firebase Admin SDK. This lets us keep client-side rules strict.
• Daily backups: Firestore (the cloud data described above) is backed up daily with 14-day retention so we can recover from accidental deletes. Your on-device journal is not part of these backups.

4. Who Can See What

• You only: your journal entries and try-list (on your device), private recommendations, your catalog contributions, your contact-discovery entry (email, optional hashed phone), support tickets, friend requests sent or received.
• You and your friends: recommendations you publish with the Friends audience, and the photos attached to them.
• Any signed-in user: recommendations you publish with the Public audience (and their photos); your profile fields (display name, username, photo, bio, home city, pronouns) when they find you by username, share code, or contacts match; combined, all-user restaurant catalog totals (never who contributed).
• The ForkMark team: what you send in a support ticket or beta feedback, plus the attached diagnostics. Administrators can also access cloud account records when needed to run the service (for example, processing a deletion request or investigating abuse). We cannot see your on-device journal.
• Defriend behavior: when you remove a friend, a server-side trigger removes that person's user ID from the visibility list on every recommendation you posted while they were a friend, so they stop seeing your recs going forward. Conversely, recs that they posted are no longer visible to you (and aren't queryable). Recommendations posted to a since-defriended audience are not retroactively re-shared if you re-friend the person.

5. Third-Party Services

We rely on the following services to deliver the App. Each has its own privacy policy covering data they receive:

• Google Firebase — Authentication, Firestore database, Cloud Storage, Cloud Functions, Firebase Messaging (push), Crashlytics, and Analytics. Hosted on Google Cloud in the us-east4 region.
• Google AdMob — displays banner ads in the free tier of the app. AdMob may collect device identifiers (IDFA on iOS, advertising ID on Android) for ad personalization, subject to your device-level tracking preferences.
• Foursquare Places API — powers nearby-restaurant search in Discover. We send the search location (GPS coordinates or ZIP-resolved coordinates) and your filters (cuisine, distance, open-now) to Foursquare via our own proxy so the API key never ships in the app. Foursquare receives no user identity from us.
• OpenStreetMap (Overpass + Nominatim) — used as a fallback for restaurant discovery and ZIP-to-location geocoding. Same approach as Foursquare — coordinates and queries only, no identity.
• Apple App Store / Google Play — app distribution. If we introduce in-app purchases in the future, payment processing will happen entirely within Apple's or Google's billing systems; we will never see your card details.
• Email delivery — transactional emails (support replies, beta-status notifications) are queued in Firestore and sent via the Firebase "Trigger Email" extension using an SMTP relay we configure.

6. Sharing & Disclosure

We do not sell, rent, or share your personal data for marketing, advertising, or any other commercial purpose. Data leaves your account only in these limited circumstances:

• Recommendation visibility. Friends-only recommendations are visible to the friends you had at publish time. Public recommendations are visible to any signed-in ForkMark user. Your profile (display name, username, photo, bio) is visible to signed-in users who find you, so they can send a friend request.
• Service providers. Limited to the integrations in section 5 and only to deliver the features they power.
• Legal compliance. If we are required to disclose data by law, valid subpoena, or court order, we will. Where legally permitted we will notify you.
• Sale or acquisition. If ForkMark is acquired or merged, your data may transfer to the successor entity under the terms of this Privacy Policy. You'll be notified before any change.

7. Advertising

The current free version of the mobile app displays banner advertisements via Google AdMob. Ads help fund ongoing development during the beta and early launch. You can opt out of personalized advertising through your device's system settings — on iOS, decline the App Tracking Transparency prompt or set Privacy & Security → Tracking; on Android, opt out under Settings → Google → Ads. With personalization disabled you'll still see ads, but they won't be tailored to your inferred interests. We may introduce an ad-free paid tier in a future release.

8. Data Retention

• Your account and cloud data are retained for as long as your account is active. On-device journal data stays on your device until you delete it, delete your account, or uninstall the app.
• You can delete individual journal entries, try-list items, and recommendations at any time from inside the app.
• Deleting your account in the app (immediate). Open Profile → Delete Account. You may be asked to sign in again first. Deletion runs right away. It removes your sign-in account, profile, recommendations, friend connections (on both sides), username and FM identifier reservations, catalog contributions, contact-discovery entry, notifications and push tokens, support tickets, beta records, and uploaded photos. It then erases the journal, try-list, and photos stored on that device.
• Deletion by request. You can also request deletion from your account page at forkmark.app/account, with an in-app Help & Support ticket (category "Account"), or by emailing support@tournamentsense.com. An administrator runs the same full cloud deletion within 30 days. We can't reach your device, so journal data stored on it is removed when you uninstall the app. We may keep certain records where the law requires it (e.g. tax, fraud, or abuse investigations), and we keep a minimal audit record that a deletion took place.
• Daily Firestore backups are retained for 14 days. After you delete your account, your cloud data persists in those rotating backups until they age out (≤14 days post-deletion). On-device journal data is never in these backups.
• Anonymous, aggregated analytics data may be retained longer; it cannot be tied back to you.

9. Children's Privacy

ForkMark is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, contact us at support@tournamentsense.com and we will delete it.

10. Your Rights

Depending on your jurisdiction (including residents of the EU, UK, and California), you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data.
• Object to or restrict processing.
• Request a portable copy of your data in a machine-readable format.
• Withdraw consent for any processing based on consent (without affecting prior lawful processing).

To exercise any of these rights, email support@tournamentsense.com. We'll respond within 30 days. We do not discriminate against users who exercise their privacy rights.

11. International Users

Our servers are operated in the United States (Google Cloud us-east4). If you use ForkMark from outside the U.S., your data will be transferred to and processed in the U.S., which may have different data-protection laws than your country of residence. By using the App you consent to this transfer.

12. Security Incident Notification

If we become aware of a security incident affecting your personal data, we will notify you and the appropriate regulators in accordance with applicable law (typically within 72 hours of confirming the incident).

13. Changes to This Policy

We may update this Privacy Policy from time to time. We'll post the updated version on this page with a revised "Last updated" date. For material changes — for example, new categories of data collected or new third-party services introduced — we'll also notify you in the app or via email. Continued use of the App after changes constitutes acceptance of the revised policy.

14. Contact Us

Questions, concerns, or requests about this Privacy Policy or how your data is handled? Email support@tournamentsense.com or open a support ticket from inside the app (Profile → Help & Support).